Server-Side Request Forgery (SSRF) vulnerability in Next.js Server Actions

CVE-2024-34351
7.5HIGH

Key Information

Vendor
Vercel
Status
Next.js
Vendor
CVE Published:
14 May 2024

Badges

πŸ”₯ No. 1 TrendingπŸ˜„ TrendedπŸ‘Ύ Exploit ExistsπŸ”΄ Public PoCπŸ“° News Worthy

Summary

Next.js has two new vulnerabilities related to response queue poisoning and Server-Side Request Forgery (SSRF) in certain versions, CVE-2024-34350 and CVE-2024-34351, both rated as high severity. Exploiting these vulnerabilities can lead to desynchronized responses and potentially compromise server operations. The vulnerabilities are in the Next.js component enabled by default, and have been patched in versions 13.5.1 and 14.x. One of the vulnerabilities, CVE-2024-34351, can be exploited in a way that allows an attacker to manipulate a front-end server and map incorrect back-end responses. A proof of concept for this vulnerability has also been published. The exploitation of these vulnerabilities can lead to serious consequences and it is critical for Next.js users to upgrade to the latest versions to prevent exploitation.

Affected Version(s)

next.js = >= 13.4.0, < 14.1.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

News Articles

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published.

  • πŸ‘Ύ

    Exploit exists.

  • First article discovered by CybersecurityNews

  • πŸ”₯

    Vulnerability reached the number 1 worldwide trending spot.

  • Vulnerability started trending.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database2 Proof of Concept(s)1 News Article(s)
.